WordPress Network Posts Extended plugin <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via postheight Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Posts Extended versions = 7.7.1...

CVE-2025-41226

creationtimestamp| type| source ---|---|--- 2025-05-20 14:48:22+00:00| seen| https://bsky.app/profile/andersonc0d3.bsky.social/post/3lpmdfkawoc2w 2025-05-20 14:48:25+00:00| seen| https://infosec.exchange/users/andersonc0d3/statuses/114540708203094327 2025-05-20 14:54:00+00:00| seen|...

CVE-2025-3079

creationtimestamp| type| source ---|---|--- 2025-05-20 00:10:11+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpksd26u73v2 2025-05-20 00:43:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpku6jj7o32j...

CVE-2025-46263

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lloyd Saunders Author Box After Posts author-box-after-posts allows Stored XSS.This issue affects Author Box After Posts: from n/a through = 1.6...

CVE-2025-39374

Cross-Site Request Forgery CSRF vulnerability in aseem1234 Best Posts Summary best-posts-summary allows Stored XSS.This issue affects Best Posts Summary: from n/a through = 1.0...

CVE-2025-39369

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sihibbs Posts for Page posts-for-page allows DOM-Based XSS.This issue affects Posts for Page: from n/a through = 2.1...

CVE-2025-46263 WordPress Author Box After Posts plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lloyd Saunders Author Box After Posts allows Stored XSS.This issue affects Author Box After Posts: from n/a through 1.6...

CVE-2025-46263 WordPress Author Box After Posts plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lloyd Saunders Author Box After Posts author-box-after-posts allows Stored XSS.This issue affects Author Box After Posts: from n/a through = 1.6...

CVE-2025-46263

CVE-2025-46263 : Stored XSS in WordPress plugin “Author Box After Posts” (versions up to and including 1.6). Root cause: improper input neutralization during web page generation. Impact is described as Cross-Site Scripting with potential user data exposure and site compromise; CVSS 3.1 base score...

CVE-2025-39374

CVE-2025-39374 : Cross-Site Request Forgery (CSRF) leading to Stored XSS in the WordPress plugin “Best Posts Summary” for versions up to 1.0. The CVE is documented with CVSS v3.1 base score 7.1 (HIGH) and network attack vector, low confidentiality/integrity/availability impact, and user interacti...

CVE-2025-39374 WordPress Best Posts Summary plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in aseem1234 Best Posts Summary best-posts-summary allows Stored XSS.This issue affects Best Posts Summary: from n/a through = 1.0...

CVE-2025-39369 WordPress Posts for Page plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sihibbs Posts for Page posts-for-page allows DOM-Based XSS.This issue affects Posts for Page: from n/a through = 2.1...

CVE-2025-39369 WordPress Posts for Page plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sihibbs Posts for Page allows DOM-Based XSS.This issue affects Posts for Page: from n/a through 2.1...

CVE-2025-39369

CVE-2025-39369 affects WordPress Posts for Page plugin (≤ 2.1). Root cause: improper neutralization of input during web page generation, enabling DOM-based XSS. Impact per sources: cross-site scripting with low privileges and user interaction required; affected versions are n/a through 2.1. Publi...

PT-2025-22027 · Unknown · Sihibbs Posts For Page

Name of the Vulnerable Software and Affected Versions: sihibbs Posts for Page versions n/a through 2.1 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS. This means that an attacker...

CVE-2025-4885

creationtimestamp| type| source ---|---|--- 2025-05-18 15:55:07+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lphg6qvn75c2 2025-05-18 17:12:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lphkjyf2ls2h...

CVE-2025-4874

creationtimestamp| type| source ---|---|--- 2025-05-18 12:53:14+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lph3y4yjose2 2025-05-18 13:08:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lph4ve4s552h...

CVE-2024-12767

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts...

CVE-2024-10639

The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-30072

creationtimestamp| type| source ---|---|--- 2025-05-17 04:23:10+00:00| seen| https://schleuss.online/users/vulnbot/statuses/114521262474751027 2025-05-17 04:55:04+00:00| seen| https://bsky.app/profile/nimblenerd.social/post/3lpdqtu6ltw24 2025-05-17 04:55:23+00:00| seen|...